Server-Side Request Forgery (SSRF) vulnerability in Next.js Server Actions

Summary

Next.js has two new vulnerabilities related to response queue poisoning and Server-Side Request Forgery (SSRF) in certain versions, CVE-2024-34350 and CVE-2024-34351, both rated as high severity. Exploiting these vulnerabilities can lead to desynchronized responses and potentially compromise server operations. The vulnerabilities are in the Next.js component enabled by default, and have been patched in versions 13.5.1 and 14.x. One of the vulnerabilities, CVE-2024-34351, can be exploited in a way that allows an attacker to manipulate a front-end server and map incorrect back-end responses. A proof of concept for this vulnerability has also been published. The exploitation of these vulnerabilities can lead to serious consequences and it is critical for Next.js users to upgrade to the latest versions to prevent exploitation.

News Articles

CybersecurityNews

CVE-2024-34351CVE-2024-34350

Critical Next.js Vulnerability Let Attackers Compromise Server Operations

Two new vulnerabilities have been discovered in Next.js which were related to response queue poisoning and SSRF on certain Next.js versions.

4 months ago